Data poisoning attacks manipulate the data samples with watermarks (intentional changes in the samples and labels to make them recognizable) to build a backdoor [1]} into the global model. In other words, the malicious participant alters their data samples and labels during the training phase and associates the altered samples with a given target label. If the attack is successful, the learned global model predicts the target label whenever the watermark is present on an input, thereby implementing a so-called backdoor.
